[vishwasvaidya-cloudsufi]

What's this about

A VRP report found a SQL injection in the Cloud SQL PostgreSQL connector's sample path. A table path containing a " could break out of the quoted name and run extra statements, like an UPDATE, using the connection's saved credential. The same issue existed in every connector.

What changed

• Connectors: table names and the strata column are now properly escaped, so a quote inside a name can't break out anymore.
• Source plugins: Import Query and Bounding Query are now parsed (JSqlParser 4.9) and must be a single SELECT. Anything else is rejected before it ever reaches the database. Use the Database action plugins for SET, EXEC, UPDATE and similar.
• SQL Server [bracket] names keep working.
• Updated 3 e2e expected log messages (SQL Server, PostgreSQL, Cloud SQL MySQL). These tests send invalid SQL on purpose, which is now rejected by the new check before reaching the database, so the error comes from our check instead of the database.

Heads up

Existing pipelines with a non-SELECT Import Query can fail after this and need to move that logic to an action.

Testing

Added unit tests for escaping in every connector, including the payload from the report, plus validator tests and end-to-end pipeline tests confirming bad queries are blocked and no data is changed. Not yet tested against real database instances.

[gemini-code-assist]

Code Review

This pull request introduces SQL identifier quoting to prevent SQL injection vulnerabilities across various database connectors, and adds query validation using jsqlparser to ensure that import and bounding queries are read-only SELECT statements. Feedback on these changes highlights several potential NullPointerException risks when database or schema parameters are null during identifier quoting, as well as a recommendation to use Locale.ROOT with toLowerCase() to avoid locale-sensitive string comparison issues.